TCP.With.FIN.Flag.Only

Release DateJul 14, 2010
SeverityLow
ImpactFingerprinting
Security Bypass
DescriptionThis indicates TCP packets with the FIN flag only ("TCP Headers With FIN Only"). Normally, TCP FIN packets also have the ACK flag to acknowledge the previous packet received.

"TCP FIN Without ACK" can be used to do FIN scan or evade detection.
Affected ProductsAny Operating System may be affected.
Recommended ActionsIf required, this signature's action can be set to "Block" to drop such packets.
Reference: VID-23753